{"id":"CVE-2026-119849","kind":"vulnerability","aliases":["CVE-2026-119849"],"related":[],"title":"Windows: Virtual Hard Disk driver overflow lets a local user run code","description":"Stack-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to execute code locally.","summary":"A stack-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver in Windows can be triggered by an authorized local attacker. The sources say it allows code execution on the affected machine.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","virtual-hard-disk","windows"],"not_affected_if":["no-local-access"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:20:02+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","triaged_at":"2026-11-10T19:51:47+00:00","updated_at":"2026-11-10T19:51:47+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-10T19:51:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows: Virtual Hard Disk driver overflow lets a local user run code","impact":"high","summary":"A stack-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver in Windows can be triggered by an authorized local attacker. The sources say it allows code execution on the affected machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","virtual-hard-disk"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Code runs with driver privileges on the local machine","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119849 for affected Windows builds, the patch, and whether the driver is loaded by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-local-access"],"who_is_affected":"Systems running Windows with the Virtual Hard Disk miniport driver, where an attacker already has a local logon. The sources do not say which Windows versions are affected or whether the driver is loaded by default.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4513,"output_tokens":445,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Check the Microsoft Security Update Guide entry for CVE-2026-119849 for affected Windows builds, the patch, and whether the driver is loaded by default.","search":"'-119849':15A,18A '-2026':14A,17A 'affect':58B 'allow':53B,72C 'attack':48B,75C 'author':46B,74C 'base':28B,62C 'buffer':29B,63C 'code':12A,54B,78C 'cve':13A,16A 'disk':4A,23B,35B,68C 'driver':5A,38B,71C 'execut':55B,77C 'hard':3A,22B,34B,67C 'infrastructur':19B 'let':7A 'local':9A,47B,79C 'machin':59B 'miniport':37B,70C 'overflow':6A,30B,64C 'run':11A 'say':51B 'sourc':50B 'stack':27B,61C 'stack-bas':26B,60C 'trigger':43B 'user':10A 'vhd':36B,69C 'virtual':2A,21B,33B,66C 'virtual-hard-disk':20B 'window':1A,24B,40B","nicknames":[],"mitigations":[],"who_affected":"Systems running Windows with the Virtual Hard Disk miniport driver, where an attacker already has a local logon. The sources do not say which Windows versions are affected or whether the driver is loaded by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","virtualharddisk","windows"],"campaign_type":null,"search_a":"'-119849':15A,18A '-2026':14A,17A 'code':12A 'cve':13A,16A 'disk':4A 'driver':5A 'hard':3A 'let':7A 'local':9A 'overflow':6A 'run':11A 'user':10A 'virtual':2A 'window':1A","search_b":"'affect':58B 'allow':53B 'attack':48B 'author':46B 'base':28B 'buffer':29B 'code':54B 'disk':23B,35B 'driver':38B 'execut':55B 'hard':22B,34B 'infrastructur':19B 'local':47B 'machin':59B 'miniport':37B 'overflow':30B 'say':51B 'sourc':50B 'stack':27B 'stack-bas':26B 'trigger':43B 'vhd':36B 'virtual':21B,33B 'virtual-hard-disk':20B 'window':24B,40B","search_c":"'allow':72C 'attack':75C 'author':74C 'base':62C 'buffer':63C 'code':78C 'disk':68C 'driver':71C 'execut':77C 'hard':67C 'local':79C 'miniport':70C 'overflow':64C 'stack':61C 'stack-bas':60C 'vhd':69C 'virtual':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119849","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119849","severity":null,"published_at":"2026-11-10T19:20:02+00:00","modified_at":"2026-11-10T19:20:02+00:00","first_seen_at":"2026-11-10T19:24:59+00:00","fetched_at":"2026-11-10T19:24:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}